pizzapimp1 Posted November 29, 2009 ID:163768 Share Posted November 29, 2009 Logfile of Trend Micro HijackThis v2.0.0 (BETA)Scan saved at 11:40:05 AM, on 11/29/2009Platform: Windows XP SP2 (WinNT 5.01.2600)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\FastNetSrv.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\wanmpsvc.exeC:\WINDOWS\Explorer.exeC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\iTunes\iTunesHelper.exeC:\WINDOWS\system32\VTTimer.exeC:\WINDOWS\system32\VTtrayp.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\HP\HP Software Update\HPWuSchd2.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Documents and Settings\All Users\Application Data\7eaa4\WS555.exeC:\WINDOWS\system32\rundll32.exeC:\Program Files\Spybot - Search & Destroy\TeaTimer.exeC:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exeC:\Program Files\HP\Digital Imaging\bin\hpqbam08.exeC:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exeC:\Program Files\Mozilla Firefox\firefox.exeF:\Computer Repair Utility Kit\Computer Repair Utility Kit\Virus and Malware Removal Tools\HiJackThis_v2.exeR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe tkjh.huo sqmtmF2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,O1 - Hosts: 74.125.45.100 4-open-davinci.comO1 - Hosts: 74.125.45.100 securitysoftwarepayments.comO1 - Hosts: 74.125.45.100 privatesecuredpayments.comO1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.comO1 - Hosts: 74.125.45.100 getantivirusplusnow.comO1 - Hosts: 74.125.45.100 secure-plus-payments.comO1 - Hosts: 74.125.45.100 www.getantivirusplusnow.comO1 - Hosts: 74.125.45.100 www.secure-plus-payments.comO1 - Hosts: 74.125.45.100 www.getavplusnow.comO1 - Hosts: 74.125.45.100 safebrowsing-cache.google.comO1 - Hosts: 74.125.45.100 www.securesoftwarebill.comO1 - Hosts: 74.125.45.100 secure.paysecuresystem.comO1 - Hosts: 74.125.45.100 paysoftbillsolution.comO1 - Hosts: 88.198.198.202 google.aeO1 - Hosts: 88.198.198.202 google.asO1 - Hosts: 88.198.198.202 google.atO1 - Hosts: 88.198.198.202 google.azO1 - Hosts: 88.198.198.202 google.baO1 - Hosts: 88.198.198.202 google.beO1 - Hosts: 88.198.198.202 google.bgO1 - Hosts: 88.198.198.202 google.bsO1 - Hosts: 88.198.198.202 google.caO1 - Hosts: 88.198.198.202 google.cdO1 - Hosts: 88.198.198.202 google.com.ghO1 - Hosts: 88.198.198.202 google.com.hkO1 - Hosts: 88.198.198.202 google.com.jmO1 - Hosts: 88.198.198.202 google.com.mxO1 - Hosts: 88.198.198.202 google.com.myO1 - Hosts: 88.198.198.202 google.com.naO1 - Hosts: 88.198.198.202 google.com.nfO1 - Hosts: 88.198.198.202 google.com.ngO1 - Hosts: 88.198.198.202 google.chO1 - Hosts: 88.198.198.202 google.com.npO1 - Hosts: 88.198.198.202 google.com.prO1 - Hosts: 88.198.198.202 google.com.qaO1 - Hosts: 88.198.198.202 google.com.sgO1 - Hosts: 88.198.198.202 google.com.tjO1 - Hosts: 88.198.198.202 google.com.twO1 - Hosts: 88.198.198.202 google.djO1 - Hosts: 88.198.198.202 google.deO1 - Hosts: 88.198.198.202 google.dkO1 - Hosts: 88.198.198.202 google.dmO1 - Hosts: 88.198.198.202 google.eeO1 - Hosts: 88.198.198.202 google.fiO1 - Hosts: 88.198.198.202 google.fmO1 - Hosts: 88.198.198.202 google.frO1 - Hosts: 88.198.198.202 google.geO1 - Hosts: 88.198.198.202 google.ggO1 - Hosts: 88.198.198.202 google.gmO1 - Hosts: 88.198.198.202 google.grO1 - Hosts: 88.198.198.202 google.htO1 - Hosts: 88.198.198.202 google.ieO1 - Hosts: 88.198.198.202 google.imO1 - Hosts: 88.198.198.202 google.inO1 - Hosts: 88.198.198.202 google.itO1 - Hosts: 88.198.198.202 google.kiO1 - Hosts: 88.198.198.202 google.laO1 - Hosts: 88.198.198.202 google.liO1 - Hosts: 88.198.198.202 google.lvO1 - Hosts: 88.198.198.202 google.maO1 - Hosts: 88.198.198.202 google.msO1 - Hosts: 88.198.198.202 google.muO1 - Hosts: 88.198.198.202 google.mwO1 - Hosts: 88.198.198.202 google.nlO1 - Hosts: 88.198.198.202 google.noO1 - Hosts: 88.198.198.202 google.nrO1 - Hosts: 88.198.198.202 google.nuO1 - Hosts: 88.198.198.202 google.plO1 - Hosts: 88.198.198.202 google.pnO1 - Hosts: 88.198.198.202 google.ptO1 - Hosts: 88.198.198.202 google.roO1 - Hosts: 88.198.198.202 google.ruO1 - Hosts: 88.198.198.202 google.rwO1 - Hosts: 88.198.198.202 google.scO1 - Hosts: 88.198.198.202 google.seO1 - Hosts: 88.198.198.202 google.shO1 - Hosts: 88.198.198.202 google.siO1 - Hosts: 88.198.198.202 google.smO1 - Hosts: 88.198.198.202 google.snO1 - Hosts: 88.198.198.202 google.stO1 - Hosts: 88.198.198.202 google.tlO1 - Hosts: 88.198.198.202 google.tmO1 - Hosts: 88.198.198.202 google.ttO1 - Hosts: 88.198.198.202 google.usO1 - Hosts: 88.198.198.202 google.vuO1 - Hosts: 88.198.198.202 google.wsO1 - Hosts: 88.198.198.202 google.co.ckO1 - Hosts: 88.198.198.202 google.co.idO1 - Hosts: 88.198.198.202 google.co.ilO1 - Hosts: 88.198.198.202 google.co.inO1 - Hosts: 88.198.198.202 google.co.jpO1 - Hosts: 88.198.198.202 google.co.krO1 - Hosts: 88.198.198.202 google.co.lsO1 - Hosts: 88.198.198.202 google.co.maO1 - Hosts: 88.198.198.202 google.co.nzO1 - Hosts: 88.198.198.202 google.co.tzO1 - Hosts: 88.198.198.202 google.co.ugO1 - Hosts: 88.198.198.202 google.co.ukO1 - Hosts: 88.198.198.202 google.co.zaO1 - Hosts: 88.198.198.202 google.co.zmO1 - Hosts: 88.198.198.202 google.comO2 - BHO: C:\WINDOWS\system32\phxjgk.dll - {B45A4B16-23F2-41AD-F4E4-00AAC39C0004} - C:\WINDOWS\system32\phxjgk.dllO4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -RunO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [VTTimer] VTTimer.exeO4 - HKLM\..\Run: [VTTrayp] VTtrayp.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [system Defender] "C:\Documents and Settings\All Users\Application Data\7eaa4\WS555.exe" /s /dO4 - HKLM\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\calc.dll,_IWMPEvents@0O4 - HKLM\..\Run: [girofaviw] Rundll32.exe "c:\windows\system32\panifiye.dll",aO4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7O4 - HKCU\..\Run: [calc] rundll32.exe C:\DOCUME~1\JODYM~1\ntuser.dll,_IWMPEvents@0O4 - HKCU\..\Run: [asg984jgkfmgasi8ug98jgkfgfb] C:\DOCUME~1\JODYM~1\LOCALS~1\Temp\smss.exeO4 - HKUS\S-1-5-18\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\config\SYSTEM~1\ntuser.dll,_IWMPEvents@0 (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\config\SYSTEM~1\ntuser.dll,_IWMPEvents@0 (User 'Default user')O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dllO9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dllO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dllO15 - Trusted Zone: http://www.msi.com.twO16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} (CPlayFirstDinerDash2Control Object) - http://aolsvc.aol.com/onlinegames/trydiner...h2.1.0.0.48.cabO16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cabO16 - DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} (WildfireActiveXHost Class) - http://aolsvc.aol.com/onlinegames/ghtumblebugs/axhost.cabO16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://aolsvc.aol.com/onlinegames/free-tri...tg.1.0.0.33.cabO20 - AppInit_DLLs: yekufubi.dll c:\windows\system32\panifiye.dllO21 - SSODL: rinoyotup - {a13148d2-abb5-45fd-9e43-8d1d24e08417} - c:\windows\system32\panifiye.dllO22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dllO22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dllO22 - SharedTaskScheduler: jkshf8a3rudbfa873fudfhbdugf87whjdb - {B45A4B16-23F2-41AD-F4E4-00AAC39C0004} - C:\WINDOWS\system32\phxjgk.dllO22 - SharedTaskScheduler: gahurihor - {a13148d2-abb5-45fd-9e43-8d1d24e08417} - c:\windows\system32\panifiye.dllO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: fastnetsrv Service (fastnetsrv) - Unknown owner - C:\WINDOWS\system32\FastNetSrv.exeO23 - Service: Google Update Service (gupdate1c9a761b9a47940) (gupdate1c9a761b9a47940) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe--End of file - 11377 bytes Link to post Share on other sites More sharing options...
Maniac Posted November 29, 2009 ID:163820 Share Posted November 29, 2009 Hello pizzapimp1! Welcome to MalwareBytes' Anti-Malware Forums!My name is Maniac and I will be glad to help you solve your problems with malware. Before we begin, please note the following: I will help you only with clean your system from malware. For other problems with your machine, start a new topic in the PC HelpThe process of cleaning your system may take some time, so please be patient.Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.Instructions that I give are for your system only!If you don't know or can't understand something please ask. Do not install any software or hardware, while work on.Now:Please visit Combofix Guide & Instructions for instructions for installing the recovery console and downloading and running ComboFix.The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to Combo-Fix.exe please.Post the log from ComboFix when you've accomplished that along with a new HijackThis log.Important notes regarding ComboFix:ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.ComboFix also prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished. Read HERE for an article written by dvk01 on why we disable autoruns.Note: During this process, it would help a great deal and be very much appreciated if you would refrain from installing any new software or hardware on this machine, unless absolutely necessary, until the clean up process is finished as it makes our job more tedious, with additional new files that may have to be researched, which is very time consuming. Also, please do not run any security programs or fixes on your own as doing so may compromise what we will be doing. It is important that you wait for instructions. Link to post Share on other sites More sharing options...
Maurice Naggar Posted December 3, 2009 ID:165620 Share Posted December 3, 2009 @pizzapimp1Please advise us soonest if you have gotten guided help elsewhere and have resolved the issues.This system has serious infections, including Vundo and an infected Hosts file.If we do not hear back from you in a day or two, we will close this thread. Please reply soonest.P.S. I have been advised by pizzapimp1 that the issues are resolved. This topic is closed. Link to post Share on other sites More sharing options...
Recommended Posts